Intrusion Detection System Based on Decision Tree over Big Data in Fog Environment

Peng, Kai; Leung, Victor C. M.; Zheng, Lixin; Wang, Shangguang; Huang, Chao; Lin, Tao

doi:10.1155/2018/4680867

Cited by 102 publications

(49 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Four existing classification algorithms are selected to build classification models for intrusion detection using packet header information. These include: Classification and Regression Trees (Peng, et al, 2018), Support Vector Machine (Jha & Ragha, 2013), Naïve Bayes (Panda & Patra, 2007), and k-Nearest Neigbour (Liao & Vemuri, 2002).…”

Section: Methodsmentioning

confidence: 99%

Abstracting Packet Header Information for Intrusion Detection in High-Speed Networks

et al. 2020

View full text Add to dashboard Cite

Increase in network traffic coupled with increasing adoption of end-to-end encryption of network packets are two major factors threatening the potency, or even the relevance, of packet-based intrusion detection techniques. Also, end-to-end encryption makes it nearly impossible for network and host-based intrusion detection system to analyze traffic for potential threats and intrusion, hence, the need for an alternative approach. Flow-based intrusion detection system has been proposed as an alternative to a packet-based intrusion detection system as it relies on information embedded in packet header and various statistical analyses of network flow for detecting intrusion. This paper proposes packet header information abstraction model for intrusion detection on the UNSW-NB15 intrusion dataset. Four existing classification algorithms which include: Classification and Regression Tree (CART), Naïve Bayes (NB), K-Nearest Neighbour (KNN), and Support Vector Machine (SVM) are used to evaluate the degree of representativeness of the proposed model using accuracy, sensitivity and specificity evaluation metrics. An average accuracy of 97.95% was recorded across the four models with the minimum accuracy of 97.76 on SVM and best accuracy of 98.05% on CART while Sensitivity of 1.0 on both CART and NB shows that the model performs well in correctly identifying attacks in the network. The average specificity of 0.98 is also an indication of low false positive. Results obtained show that the proposed abstraction model achieves high accuracy, sensitivity and specificity. The model can be used as filter on a high-speed network whereby packets flagged as an attack can be subjected to further analysis.Keywords—Data Abstraction, Data Mining,Flow-based, Intrusion detection, Network Security

show abstract

Section: Methodsmentioning

confidence: 99%

Abstracting Packet Header Information for Intrusion Detection in High-Speed Networks

et al. 2020

View full text Add to dashboard Cite

show abstract

“…Full KDDCup1999 dataset has been used to test the proposed model. Peng et al [9] used classification machine learning technique. The authors proposed an IDS system based on decision tree over Big Data in Fog Environment.…”

Section: Related Workmentioning

confidence: 99%

Intrusion detection model using machine learning algorithm on Big Data environment

et al. 2018

View full text Add to dashboard Cite

Introduction Big Data is the data that are difficult to store, manage, and analyze using traditional database and software techniques. Big Data includes high volume and velocity, and also variety of data that needs for new techniques to deal with it. Intrusion detection system (IDS) is hardware or software monitor that analyzes data to detect any attack toward a system or a network. Traditional intrusion detection system techniques make the system more complex and less efficient when dealing with Big Data, because its analysis properties process is complex and take a long time. The long time it takes to analyze the data makes the system prone to harms for some period of time before getting any alert [1, 2]. Therefore, using Big Data tools and techniques to analyze and store data in intrusion detection system can reduce computation and training time. The IDS has three methods for detecting attacks; Signature-based detection, Anomaly-based detection, and Hybrid-based detection. The signature-based detection is designed to detect known attacks by using signatures of those attacks. It is an effective method of detecting known attacks that are preloaded in the IDS database. Therefore, it is often considered to be much more accurate at identifying an intrusion attempt of Abstract Recently, the huge amounts of data and its incremental increase have changed the importance of information security and data analysis systems for Big Data. Intrusion detection system (IDS) is a system that monitors and analyzes data to detect any intrusion in the system or network. High volume, variety and high speed of data generated in the network have made the data analysis process to detect attacks by traditional techniques very difficult. Big Data techniques are used in IDS to deal with Big Data for accurate and efficient data analysis process. This paper introduced Spark-Chi-SVM model for intrusion detection. In this model, we have used ChiSqSelector for feature selection, and built an intrusion detection model by using support vector machine (SVM) classifier on Apache Spark Big Data platform. We used KDD99 to train and test the model. In the experiment, we introduced a comparison between Chi-SVM classifier and Chi-Logistic Regression classifier. The results of the experiment showed that Spark-Chi-SVM model has high performance, reduces the training time and is efficient for Big Data.

show abstract

“…Moreover, because the MEC can be seen as a network of multiple nodes, the assessment of node importance [117] and the assessment of invulnerability [118] of MEC also needs to be investigated. In our previous research [119], an Intrusion Detection System (IDS) was developed based on decision tree. Firstly, we developed a preprocessing algorithm to digitize the strings in the given dataset and then normalized the whole data.…”

Section: Other Issuesmentioning

confidence: 99%

A Survey on Mobile Edge Computing: Focusing on Service Adoption and Provision

Peng

Leung

et al. 2018

Wireless Communications and Mobile Computing

Self Cite

View full text Add to dashboard Cite

Mobile cloud computing (MCC) integrates cloud computing (CC) into mobile networks, prolonging the battery life of the mobile users (MUs). However, this mode may cause significant execution delay. To address the delay issue, a new mode known as mobile edge computing (MEC) has been proposed. MEC provides computing and storage service for the edge of network, which enables MUs to execute applications efficiently and meet the delay requirements. In this paper, we present a comprehensive survey of the MEC research from the perspective of service adoption and provision. We first describe the overview of MEC, including the definition, architecture, and service of MEC. After that we review the existing MUs-oriented service adoption of MEC, i.e., offloading. More specifically, the study on offloading is divided into two key taxonomies: computation offloading and data offloading. In addition, each of them is further divided into single MU offloading scheme and multi-MU offloading scheme. Then we survey edge server- (ES-) oriented service provision, including technical indicators, ES placement, and resource allocation. In addition, other issues like applications on MEC and open issues are investigated. Finally, we conclude the paper.

show abstract

Intrusion Detection System Based on Decision Tree over Big Data in Fog Environment

Cited by 102 publications

References 14 publications

Abstracting Packet Header Information for Intrusion Detection in High-Speed Networks

Abstracting Packet Header Information for Intrusion Detection in High-Speed Networks

Intrusion detection model using machine learning algorithm on Big Data environment

A Survey on Mobile Edge Computing: Focusing on Service Adoption and Provision

Contact Info

Product

Resources

About